# Fastcgi Pentesting

> Pentest FastCGI services (typically port 9000) for enumeration, RCE, and SSRF exploitation. Use this skill whenever you need to test FastCGI/PHP-FPM services, probe for misconfigurations, craft FastCGI payloads for RCE, or leverage SSRF to reach internal FastCGI listeners. Trigger on mentions of FastCGI, PHP-FPM, port 9000, FPM status pages, or when you need to exploit FastCGI misconfigurations.

- Skill: `abelrguezr/fastcgi-pentesting` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/fastcgi-pentesting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/fastcgi-pentesting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/fastcgi-pentesting

---


# FastCGI Pentesting Skill

A skill for enumerating and exploiting FastCGI services, particularly PHP-FPM instances running on port 9000.

## When to Use This Skill

Use this skill when:
- You discover port 9000 open on a target
- You need to test FastCGI/PHP-FPM services for vulnerabilities
- You have an SSRF primitive and want to reach internal FastCGI listeners
- You suspect Nginx FastCGI misconfigurations (cgi.fix_pathinfo issues)
- You need to craft FastCGI payloads for RCE
- You're investigating PHP-FPM related vulnerabilities

## Quick Reference

| Task | Command/Script |
|------|----------------|
| Port scan | `nmap -sV -p9000 <target>` |
| Probe FPM status | `scripts/probe-fpm-status.sh <host>` |
| FastCGI RCE | `scripts/fastcgi-rce.sh <host> <filepath>` |
| SSRF payload | `scripts/build-gopher-payload.py <host> <port> <filepath>` |

## Enumeration

### 1. Initial Reconnaissance

FastCGI typically runs on port 9000 and often only listens on localhost. Start with:

```bash
nmap -sV -p9000 <target>
```

Note: nmap often shows "unknown" service for FastCGI. Manual testing is required.

### 2. Probe FPM Status Page

PHP-FPM often exposes a status page at `/status`. Use the bundled script:

```bash
./scripts/probe-fpm-status.sh <host>
```

Or manually:

```bash
SCRIPT_FILENAME=/status SCRIPT_NAME=/status REQUEST_METHOD=GET \
  cgi-fcgi -bind -connect <host>:9000
```

### 3. SSRF to FastCGI

If you have an SSRF vulnerability in an HTTP service, you can reach internal FastCGI listeners:

```bash
./scripts/build-gopher-payload.py <host> <port> <script-path>
```

This generates a gopher:// payload you can use in your SSRF.

### 4. Check for Nginx Misconfigurations

Look for `cgi.fix_pathinfo=1` combined with improper `fastcgi_split_path_info` rules. If present, you can often append `/.php` to static files to execute PHP code.

## Exploitation

### RCE via FastCGI Request

The most reliable RCE method is sending a crafted FastCGI request with PHP payload injection:

```bash
./scripts/fastcgi-rce.sh <host> <existing-php-file-path>
```

**How it works:**
- Sets `auto_prepend_file` via `PHP_VALUE` environment variable
- Prepends a base64-encoded PHP payload to every request
- Executes arbitrary commands via `system()`

**Example:**
```bash
./scripts/fastcgi-rce.sh 192.168.1.100 /var/www/html/index.php
```

### SSRF/Gopher Payload for Internal FastCGI

When port 9000 isn't directly reachable but you have SSRF:

```bash
./scripts/build-gopher-payload.py 127.0.0.1 9000 /var/www/html/index.php
```

The script outputs a URL-safe payload. Use it like:
```
gopher://<host>:9000/_<base64-payload>
```

### Known Vulnerabilities

**libfcgi <= 2.4.4 Integer Overflow (2024)**
- Crafted `nameLen`/`valueLen` in FastCGI records can overflow on 32-bit builds
- Common in embedded/IoT devices
- Yields heap RCE when FastCGI socket is reachable

**PHP-FPM Log Manipulation (CVE-2024-9026)**
- When `catch_workers_output = yes`, attackers can truncate/inject up to 4 bytes per log line
- Useful for erasing indicators or poisoning logs

**Classic Nginx + cgi.fix_pathinfo**
- If `fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;` lacks file existence checks
- Any path ending in `.php` gets executed
- Enables path traversal or source overwrite attacks

## Scripts Reference

### probe-fpm-status.sh
Probes the PHP-FPM status page to confirm service and gather info.

### fastcgi-rce.sh
Sends a FastCGI request with PHP payload injection for RCE.

### build-gopher-payload.py
Builds a gopher:// payload for SSRF-based FastCGI exploitation.

## Workflow

1. **Scan** - Identify port 9000 with nmap
2. **Probe** - Test FPM status page with `probe-fpm-status.sh`
3. **Exploit** - Use `fastcgi-rce.sh` for direct access or `build-gopher-payload.py` for SSRF
4. **Verify** - Check output for command execution confirmation

## References

- [FastCGI library integer overflow leading to RCE](https://cybersecuritynews.com/fastcgi-integer-overflow-flaw/)
- [CVE-2024-9026 PHP-FPM log manipulation analysis](https://cyrisk.com/security/cve-2024-9026-log-manipulation/)
- [phith0n's FastCGI RCE script](https://gist.github.com/phith0n/9615e2420f31048f7e30f3937356cf75)